lkml.org 
[lkml]   [2019]   [Jul]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 06/47] firmware: improve LSM/IMA security behaviour
    Date
    From: Sven Van Asbroeck <thesven73@gmail.com>

    commit 2472d64af2d3561954e2f05365a67692bb852f2a upstream.

    The firmware loader queries if LSM/IMA permits it to load firmware
    via the sysfs fallback. Unfortunately, the code does the opposite:
    it expressly permits sysfs fw loading if security_kernel_load_data(
    LOADING_FIRMWARE) returns -EACCES. This happens because a
    zero-on-success return value is cast to a bool that's true on success.

    Fix the return value handling so we get the correct behaviour.

    Fixes: 6e852651f28e ("firmware: add call to LSM hook before firmware sysfs fallback")
    Cc: Stable <stable@vger.kernel.org>
    Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>
    Cc: Kees Cook <keescook@chromium.org>
    To: Luis Chamberlain <mcgrof@kernel.org>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Cc: "Rafael J. Wysocki" <rafael@kernel.org>
    Cc: linux-kernel@vger.kernel.org
    Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com>
    Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/base/firmware_loader/fallback.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/base/firmware_loader/fallback.c
    +++ b/drivers/base/firmware_loader/fallback.c
    @@ -659,7 +659,7 @@ static bool fw_run_sysfs_fallback(enum f
    /* Also permit LSMs and IMA to fail firmware sysfs fallback */
    ret = security_kernel_load_data(LOADING_FIRMWARE);
    if (ret < 0)
    - return ret;
    + return false;

    return fw_force_sysfs_fallback(opt_flags);
    }

    \
     
     \ /
      Last update: 2019-07-18 05:07    [W:4.051 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site